CVE-2023-6654

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-6654
A vulnerability classified as critical was found in PHPEMS 6.x/7.x/8.x/9.0. Affected by this vulnerability is an unknown functionality in the library lib/session.cls.php of the component Session Data Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247357 was assigned to this vulnerability.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://note.zhaoj.in/share/jw4Hp9cq7T69 Permissions Required
https://vuldb.com/?ctiid.247357 Permissions Required Third Party Advisory VDB Entry
https://vuldb.com/?id.247357 Permissions Required Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:phpems:phpems:6.0:*:*:*:*:*:*:*
cpe:2.3:a:phpems:phpems:7.0:*:*:*:*:*:*:*
History

11 Jan 2024, 16:15

Type Values Removed Values Added
Summary (en) A vulnerability classified as critical was found in PHPEMS 6.x/7.0. Affected by this vulnerability is an unknown functionality in the library lib/session.cls.php of the component Session Data Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247357 was assigned to this vulnerability. (en) A vulnerability classified as critical was found in PHPEMS 6.x/7.x/8.x/9.0. Affected by this vulnerability is an unknown functionality in the library lib/session.cls.php of the component Session Data Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247357 was assigned to this vulnerability.

14 Dec 2023, 17:17

Type Values Removed Values Added
First Time Phpems phpems
Phpems
CVSS v2 : 6.5
v3 : 6.3 		v2 : 6.5
v3 : 8.8
CPE cpe:2.3:a:phpems:phpems:6.0:*:*:*:*:*:*:*
cpe:2.3:a:phpems:phpems:7.0:*:*:*:*:*:*:*
References () https://note.zhaoj.in/share/jw4Hp9cq7T69 - () https://note.zhaoj.in/share/jw4Hp9cq7T69 - Permissions Required
References () https://vuldb.com/?ctiid.247357 - () https://vuldb.com/?ctiid.247357 - Permissions Required, Third Party Advisory, VDB Entry
References () https://vuldb.com/?id.247357 - () https://vuldb.com/?id.247357 - Permissions Required, Third Party Advisory, VDB Entry

11 Dec 2023, 12:20

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad fue encontrada en PHPEMS 6.x/7.0 y clasificada como crítica. Una función desconocida en la librería lib/session.cls.php del componente Session Data Handler es afectada por esta vulnerabilidad. La manipulación conduce a la deserialización. El ataque se puede lanzar de forma remota. El exploit ha sido divulgado al público y puede utilizarse. A esta vulnerabilidad se le asignó el identificador VDB-247357.

10 Dec 2023, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-10 15:15

Updated : 2024-04-11 01:23

NVD link : CVE-2023-6654

Mitre link : CVE-2023-6654

CVE.ORG link : CVE-2023-6654

JSON object : View

Products Affected

phpems

  • phpems
CWE
CWE-502

Deserialization of Untrusted Data